Being Found: SEO, Speed, and AI Answers

This year, host Bryan Mills has cleaned up multiple hacked WordPress sites, including one where a single outdated plugin handed the attacker a file manager: open any file, write straight to the database. Here's what the attacker knew about that organization before striking: nothing. A bot read a version number, and that was the whole crime. This episode is security with no dread and no jargon: four ordinary enemies, one afternoon of defenses, and a calm script for the bad day the defenses make unlikely. Bryan names the four attacks small sites actually face, brute force, malware through outdated software, AI-quality phishing, and form spam, and, just as usefully, the exotic threats you have permission to ignore. Then the baseline, nearly all of it free: the update schedule as the highest-value security control you hold, unique vaulted passwords, two-factor authentication on every account that could cause an incident, the one habit that defeats phishing even when the fake is perfect (never log in through a link in a message), and least privilege, including why publishing should never happen from an account that can delete the site. Then the walls and alarms, tuned rare enough to matter, and the hour-by-hour incident script with a tested backup at its center. On the Question Line: a board chair says, "We're a tiny nonprofit; nobody is going to bother hacking us," and we hand you the two-minute answer that wins the room. In the Tool Minute: Have I Been Pwned, the free breach check that makes the whole argument concrete in ninety seconds. Quick win: count your CMS administrator accounts, demote or delete the extras, and turn on 2FA for the rest. In This Episode The four enemies: brute force, malware via update gaps, industrialized phishing, and form spam, plus the anatomy of a real small-site compromise Scope discipline as a security practice: the exotic threats to ignore, and the one setting that retires form spam for the year The baseline cost question: what would it cost to send the email that begins "We are writing to let you know about a security incident"? The phishing habit that survives perfect fakes, and the no-blame reporting norm that turns clicks into early warnings Least privilege in practice: never fewer than two admins, no shared logins anywhere, and offboarding as a security event Walls and alarms: two free layers, three settings, and the alert-fatigue tuning that keeps the rare message loud The incident script: confirm, contain, rotate, restore onto an updated platform, and write the log entry that closes the loop Myth busted: "we're too small to be a target" The Question Line: the board chair's objection, answered in two minutes (send yours in via the link below) The Tool Minute: Have I Been Pwned

Last year, host Bryan Mills audited a client site whose homepage still read, "Coming in 2008. We'll see you soon!" On another project he found a pitch page for a co-founder who had left roughly fifteen years earlier, still pulling traffic, because Google never stopped sending people there. Both pages were live, working, and lying, and nobody knew. Content is not a launch event; it's a garden, and this episode gives the aging an owner. Bryan walks the content audit that hands every page one of four verdicts, keep, update, merge, or delete, with the one safety rule that turns deletion into pruning instead of vandalism: never remove a page with traffic or links without a 301 redirect to its closest living relative. Then governance sized for a two-person shop: the four-eyes rule, platform roles mapped to least privilege, and the burst-and-silence publishing cycle that tells visitors and search engines the enthusiasm collapsed. Then update policy as security policy, the weekly half hour called update Tuesday, and the episode's centerpiece: the maintenance calendar that gathers every cadence from the whole season into one owned, dated system costing three to five honest hours a month. On the Question Line: a client wants fifty AI-written blog posts to "fill out the site for SEO," and we make the smaller, better counter-offer. In the Tool Minute: Screaming Frog, the crawler that finds the pages your platform forgot. Quick win: find the three oldest pages among your most-visited in Search Console and update one this week. In This Episode The content audit: four verdicts, two columns of evidence (last updated, traffic), and the five-check update pass that takes ten to twenty minutes per page The delete safety rule: check Search Console first, then a 301 redirect; pruning, not vandalism Governance without bureaucracy: the four-eyes rule, least-role mapping, and why publishing should never require the account that can delete the site The burst-and-silence cycle, and sizing your publishing rhythm to your true capacity Update Tuesday: the fixed weekly sequence, auto-update versus manual by site criticality, and why an unapplied update is an advertised vulnerability The maintenance calendar: weekly, monthly, quarterly, annual tiers, and the honest three-to-five-hours-a-month bill Myth busted: "more pages = better SEO" The Question Line: fifty AI-written posts, declined with a better offer (send yours in via the link below) The Tool Minute: Screaming Frog

Around 2008, host Bryan Mills sat down with a nonprofit whose own board member could not use the organization's website: a screen reader met a site with no image descriptions and no way to reach the menu without a mouse. Nobody had locked him out on purpose. Nobody ever does it on purpose. That project is where accessibility stopped being a compliance word and became a person, and it drives this episode's claim: design, mobile, and accessibility are not talents. They're systems, and an accidental web manager can build all three. Bryan walks the one-page minimum viable brand kit that makes an organization look like one organization everywhere it appears, enforced by templates instead of policing. Then mobile, with the blunt conclusion the traffic forced: the phone version is not a version, it is the site, and a ten-minute walk with your own phone produces your design to-do list free of charge. Then the centerpiece: the eight accessibility fixes a careful non-designer can make from ordinary editing screens, why the same structure now feeds the AI systems deciding whether to cite you, and an honest warning about overlay widgets, the sticker over the lock that keeps showing up in lawsuits it promised to prevent. On the Question Line: a vendor quotes a zero-budget nonprofit board five hundred dollars a year for an overlay promising "full ADA compliance," and we script the honest counter-proposal. In the Tool Minute: the WebAIM Contrast Checker, pass-or-fail contrast answers in sixty seconds. Quick win: run your homepage through WAVE and fix every missing alt text it finds today. In This Episode The minimum viable brand kit: one folder, one page, two fonts, four hex codes, and tone notes, enforced by making the consistent path the effortless one Mobile: readability, touch targets, thumb reach, and why the first screenful is the most valuable property on the site The cost question: if one in four of your visitors found the front door locked, how long would you leave it that way? The eight accessibility fixes: alt text, contrast, real headings, link text, keyboard operability, form labels, captions, and never letting color alone carry meaning Why accessibility work now also serves AI visibility, ahead of Episode 10's GEO deep dive Hiring help without getting fleeced: three green flags, three red flags, full contracting toolkit in Episode 16 Myth busted: "accessibility is only for big companies" The Question Line: the $500 per year overlay widget pitch, dismantled (send yours in via the link below) The Tool Minute: WebAIM Contrast Checker

Most "platform problems" are content, maintenance, or strategy problems wearing a disguise, and switching platforms moves the disguise, not the problem. The stale pages board the moving truck; the invoice runs four figures. Host Bryan Mills speaks from experience: he built more than five hundred client sites on a platform that no longer exists, and when Adobe shut down Business Catalyst, not one of his clients suffered an outage, because every site had a planned exit. That history drives this episode's central question, the one to ask of any platform pitch: what does it cost to leave? Bryan tours the big five, WordPress, Squarespace, Wix, Webflow, and Shopify, through the five axes that outlast every feature list: three-year cost, control, maintenance burden, lock-in, and commerce readiness. Then the honest math of build versus buy versus hire: a worked three-year total cost of ownership where the "free" platform lands at twice the cash cost of the subscription, and the line everyone wrongly zeroes out, your own hours. Finally, plugin maintenance debt and the four questions to ask before any install, plus the fix-extend-migrate decision tree that answers re-platforming enthusiasm with numbers instead of arguments. On the Question Line: a colleague insists the Wix site should move to WordPress "because that's what real businesses use," and the decision tree takes the question apart. In the Tool Minute: BuiltWith, the ninety-second lookup that tells you what any website runs on before you walk into a vendor meeting. Quick win: run your site through a free stack scanner and learn, in ninety seconds, exactly what your stack broadcasts to any curious outsider. In This Episode The five evaluation axes that outlast every platform, including the AI site builders with no meaningful export at all The big five in two families: open-source WordPress versus the hosted platforms, and why the maintenance axis quietly decides for accidental web managers Build versus buy versus hire over three years: the worked TCO example, the hire path's hidden subscriptions, and pricing your own hours honestly Plugin maintenance debt: the four questions at the door, the replaceability trap, and why deactivating is not removing The fix-extend-migrate decision tree, and the meeting move that answers platform enthusiasm without spending political capital Myth busted: "we need a custom-built site to look professional" The Question Line: "real businesses use WordPress," dismantled branch by branch (send yours in via the link below) The Tool Minute: BuiltWith, for scouting, verifying vendor claims, and seeing who migrated away from what

How long can your website be down before it starts to cost you money? That question, not the feature list, is how to shop for hosting, and its twin is harder: if the site vanished this afternoon, how much recent work could you afford to lose forever? Host Bryan Mills walks the building your website actually lives in. First, the hosting landscape translated from marketing into situations: shared hosting as the apartment building, VPS as the townhouse, managed hosting as the full-service building that is often the best money in an accidental web manager's budget, and the two truths about hosting prices (the renewal rate is the real rate, and expensive does not mean reliable). Then the padlock: why SSL certificates should cost nothing, the five-minute verification most people never run, mixed content, and the industry's shift to dramatically shorter certificate lifespans. And then the hill Bryan is prepared to die on: backups. The 3-2-1 rule in plain terms, why the host's own backup can never be your only copy, and the quarterly restore test that turns a backup from a hope into a plan. Plus the free supporting cast, uptime monitoring, CDNs, staging, and how to tell a genuine reason to switch hosts from a mood. Two new standing segments debut this week. The Question Line takes on a classic: a board member offers to save $180 a year by moving the website to his nephew's server, and Bryan scripts the decline that doesn't insult anybody's nephew. And the Tool Minute covers Cloudflare's free tier, the CDN-plus-DNS combination that costs nothing and speeds up everything. Quick win: a free uptime monitor on your homepage, so you learn about the next outage from a notification instead of a customer. In This Episode The four kinds of hosting matched to situations, not specifications, and why support quality outweighs every spec on the day something breaks The renewal-rate trap: the advertised price is the introductory price, and the real monthly cost is the total paid divided by the months it covers SSL/TLS verified in five minutes: the padlock, the forced https redirect, mixed content, and the coming 47-day certificate lifespan The 3-2-1 backup rule, why host backups die with the host account, and the quarterly restore test with a dated, signed log Uptime monitors, CDNs, and staging: the cheap layers, and which sites can honestly skip staging Red flags versus false flags for switching hosts, and the drama-free migration procedure Myth busted: "my host does backups, so I'm covered" NEW, the Question Line: declining the nephew's server with a scorecard instead of a fight (send yours in via the link below) NEW, the Tool Minute: Cloudflare's free tier, two tools in one account